Skip to content

Commit

Permalink
mtd: mtd_blkdevs: don't increase 'open' count on error path
Browse files Browse the repository at this point in the history
Some error paths in mtd_blkdevs were fixed in the following commit:

    commit 94735ec
    mtd: mtd_blkdevs: fix error path in blktrans_open

But on these error paths, the block device's `dev->open' count is
already incremented before we check for errors. This meant that, while
the error path was handled correctly on the first time through
blktrans_open(), the device is erroneously considered already open on
the second time through.

This problem can be seen, for instance, when a UBI volume is
simultaneously mounted as a UBIFS partition and read through its
corresponding gluebi mtdblockX device. This results in blktrans_open()
passing its error checks (with `dev->open > 0') without actually having
a handle on the device. Here's a summarized log of the actions and
results with nandsim:

    # modprobe nandsim
    # modprobe mtdblock
    # modprobe gluebi
    # modprobe ubifs
    # ubiattach /dev/ubi_ctrl -m 0
    ...
    # ubimkvol /dev/ubi0 -N test -s 16MiB
    ...
    # mount -t ubifs ubi0:test /mnt
    # ls /dev/mtdblock*
    /dev/mtdblock0  /dev/mtdblock1
    # cat /dev/mtdblock1 > /dev/null
    cat: can't open '/dev/mtdblock4': Device or resource busy
    # cat /dev/mtdblock1 > /dev/null

    CPU 0 Unable to handle kernel paging request at virtual address
    fffffff0, epc == 8031536c, ra == 8031f280
    Oops[#1]:
    ...
    Call Trace:
    [<8031536c>] ubi_leb_read+0x14/0x164
    [<8031f280>] gluebi_read+0xf0/0x148
    [<802edba8>] mtdblock_readsect+0x64/0x198
    [<802ecfe4>] mtd_blktrans_thread+0x330/0x3f4
    [<8005be98>] kthread+0x88/0x90
    [<8000bc04>] kernel_thread_helper+0x10/0x18

Cc: [email protected] [3.0+]
Signed-off-by: Brian Norris <[email protected]>
Signed-off-by: Artem Bityutskiy <[email protected]>
Signed-off-by: David Woodhouse <[email protected]>
  • Loading branch information
computersforpeace authored and David Woodhouse committed Jan 9, 2012
1 parent 8c34233 commit 342ff28
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion drivers/mtd/mtd_blkdevs.c
Original file line number Diff line number Diff line change
Expand Up @@ -215,7 +215,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)

mutex_lock(&dev->lock);

if (dev->open++)
if (dev->open)
goto unlock;

kref_get(&dev->ref);
Expand All @@ -235,6 +235,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
goto error_release;

unlock:
dev->open++;
mutex_unlock(&dev->lock);
blktrans_dev_put(dev);
return ret;
Expand Down

0 comments on commit 342ff28

Please sign in to comment.